hasura / hasura/graphql-engine
Graphql endpoints for child tables/views should only be accessible via parent relationship
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
Scenario - assume we have 2 tables. account (parent) and balances(child).
User should only be able to fetch balances via account query.
balances query shouldn't be available in graphql schema.
Permission of account(parent) table is configured and auto apply for balances on query through relationship.
Same permission cascade apply for views.
Contributor guide
Research direction
The issue provides no file or test path; begin by locating the code that exposes table and view GraphQL endpoints and applies permissions across relationships. Done means balances and analogous views are unavailable as standalone queries, remain reachable through the account relationship, and inherit the parent table's permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api, authorization, database
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100